Sign/Notarize releases

[sashkab]

I just installed Finicky via brew cask install finicky and it turns out that Finicky.app is not signed for GateKeeper and not notarized with Apple.

$ codesign -dvvv  /Applications/Finicky.app
Executable=/Applications/Finicky.app/Contents/MacOS/Finicky
Identifier=net.kassett.finicky
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20100 size=1572 flags=0x2(adhoc) hashes=42+5 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=3ad68f568cec6ee63e87ec4968fbda51d630c06e
Hash choices=sha256
CDHash=3ad68f568cec6ee63e87ec4968fbda51d630c06e
Signature=adhoc
Info.plist entries=26
TeamIdentifier=not set
Sealed Resources version=2 rules=13 files=24
Internal requirements count=0 size=12

This results in window like that shown on first start:

I can safely right click and select open to use the app, but it would be nice if this extra step won't be required.

Few links:

• Notarizing Your App Before Distribution
• Signing Your Apps for Gatekeeper

I understand this might be time consuming, but should be free to create a developer id to sign and/or notarize the app.

Thanks!

[johnste]

As far as I know signing the application requires an Apple developer license which has a cost attached to it (around $100/year I think) Since I'm not making money from finicky I'd rather not add any costs to develop it other than my time. If I'm not mistaken the only difference is that it can't be distributed through the app store and there's a warning displayed when you launch the app for the first time.

[sashkab]

Apple Developer account is free, as far as I know. You will need to get your developer certificate and it should be straight forward.

Paid account required if you plan to publish app in the App Store.

• Upload a macOS app to be notarized

[johnste]

Okay, thank you for correcting me. :) I'll look into signing the application. I'm on summer vacation right now so progress is a bit slower than usual.

…

On Wed, Jul 31, 2019, 15:30 Aleks Bunin ***@***.***> wrote: Apple Developer account is free, as far as I know. You will need to get your developer certificate and it should be straight forward. Paid account required if you plan to publish app in the App Store. - Upload a macOS app to be notarized <https://help.apple.com/xcode/mac/current/#/dev88332a81e> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#68?email_source=notifications&email_token=AAGYKI6ZHTFDHFE2HYPWLYDQCGHY7A5CNFSM4IIGN4SKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3HIB5Y#issuecomment-516849911>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAGYKI36J3JYJIB2SIATZ4LQCGHY7ANCNFSM4IIGN4SA> .

[johnste]

I've been looking into this some more today, and (unless I am mistaken) to generate a developer certificate I need to enroll with the Apple Developer Program, which is 999 SEK (~100 USD) per year. For now this will have to wait.

[wad3g]

Signing/notarizing the app would obv be ideal, but by saying, "..Apple soon will require all macOS Catalina apps to be notarized' is terribly misleading, imo. I would interpret that as I will no longer have the ability to run 3rd party/unsigned apps, and by removing the option to "Allow apps from unknown sources" in the UI it would appear that is correct.

Devs releasing apps, such as finicky, should not be required to sign up and pay for an Apple Developer account. This is just step 1 of the process. It wouldn't surprise me if in the future actually won't be to run 3rd party/unsigned apps at all.

This change, obviously centered around "security" of it's users. While a large portion of macOS users will be less vulnerable, some of the users who need to run these types of apps are going to be more vulnerable by completely disabling Gatekeeper with sudo spctl --master-disable.

/rant

@johnste 'preciate all the work you've put into finicky. It flies under the radar since you don't actually interact with the app when it's doing it's thing the control it give you/ability to coral work versus personal items is soooo underrated.

[schrej]

Afaik you can still run unsigned apps using ctrl-click > open, like you used to, no need to completely disable gatekeeper.

[bartvdo]

Note that Little Snitch will put up a not signed warning as well when Finicky looks up a url (for example because of expanding shortend urls) that is intercepted.

I didn't have any problem opening it though when installing thru homebrew. My settings are slightly lower in security already.

[johnste]

Fixed in Finicky 3.0.0 https://github.com/johnste/finicky/releases/tag/v3.0.0